Host Details
This article shows you how to click open any host during packet capture and see its full profile on a single screen: who it belongs to (ASN / organization / registration), where it is (geo map), how healthy its certificate is (TLS checkup + rating), and what technology it runs (web tech stack). It works whether you have an IP or a domain name — just click and look it up. Useful for troubleshooting, security auditing, and asset inventory.
1. When to Use It
It fits you if any of the following applies:
- You captured a flow and want to know who the peer actually is — which data center / ISP it goes through, which organization it belongs to.
- You are doing a security audit: you want to verify whether the certificate is trusted, whether it is about to expire, and whether the cipher suites are strong enough.
- You are doing asset inventory / traceback: you want to follow a certificate and dig out every hostname and related subdomain it covers in one pass.
- You want to get the abuse contact for a given IP so you can file a complaint.
In short: in an ordinary capture tool, a flow stops at "one IP + one domain name." When you want to see more, open the host profile.
2. Prerequisites
- TraceEagle is installed and running.
- You have a captured flow, or a known IP / domain / SNI.
- Lookup requires network access (ownership, geolocation, DNS, certificate checkup, and similar data are fetched in real time).
3. Step-by-Step
1. Find a clickable host
Anywhere the UI shows a captured hostname / IP / SNI, you can click to open the profile. Common entry points:
- The destination IP and hostname in HTTP flow details.
- The destination IP and SNI in TCP / TLS flow details.
- Right-click in the traffic list or packet view and choose "View Host Details" from the menu.
- The peer host in the live connections panel.
2. Click to open the profile
After you click a host, the profile panel auto-fills and starts querying; the full results appear shortly. Below we walk through each section from top to bottom.
3. Look at ownership (whose IP is this)
- The resolved IP and reverse DNS (PTR).
- ASN: number + name + announced route prefix (CIDR).
- The organization, registry, and country.
- The netblock (CIDR + allocation type).
- The abuse contact — use it directly to file a complaint.
4. Look at geolocation (where it is)
- City / region / country (including ISO code).
- The host's exact location is marked directly on a world map, visible at a glance.
5. Look at DNS records
- A / AAAA / MX records, showing type / value / TTL.
6. Look at the TLS certificate checkup (is it secure)
This is the section security audits consult most often:
- The A / B / C / F security rating (highlighted color code), so you can judge health at a glance.
- Whether the hostname matches, whether the certificate chain is trusted, and expiry status (expired / days remaining).
- TLS version, certificate issuer and subject (organization).
- Together with TLS auditing you can go further and see:
- The full certificate chain (subject / issuer / validity period / days remaining / DNS names / is CA / key type / signature algorithm / self-signed).
- The list of supported protocols, the cipher suites and their strength (weak-suite / forward-secrecy flags), and the suite actually negotiated in this handshake.
- Certificate Transparency (CT) logs — list every hostname covered by a certificate in one pass along with the total count, digging out related subdomains that never appeared in the traffic. This is where you dig deeper during traceback.
7. Look at the web tech stack (what it runs)
- Page title, Server header.
- Recognized servers / frameworks / CMSs / libraries, displayed as tags.
4. Verification: Confirm the Lookup Succeeded
After opening a profile, check the following points to confirm the information is in place:
- The ownership section shows ASN, organization, and country — not blank.
- A marker appears on the map.
- The certificate checkup gives an A / B / C / F rating color code.
- If the target is a website, the tech stack section shows recognized tags.
If a section does not appear, it is most likely that the target itself has no such information (for example, a bare IP has no domain name, and a non-HTTPS target has no certificate section) — it is not a failed lookup.
5. Tips / Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Clicking does nothing / profile is blank | You did not click a recognizable host, or there is no network access | Confirm you clicked an IP / hostname / SNI; confirm the network is available and reopen |
| The certificate checkup section is empty | This flow is not HTTPS, so there is no certificate to inspect | This is normal; try a TLS flow instead |
| Only an IP, no domain / tech stack | The peer really is a bare IP with no domain bound, or is not a web service | Just check ownership, geolocation, and the certificate; the tech stack depends on there being a web page |
| You want to look up a related subdomain that never appeared in the traffic | It is hidden in the certificate | Expand the CT logs; every hostname covered by the certificate is listed at once |
| The rating is low (C / F) | Something is wrong with the certificate or the encryption configuration | Expand it to see whether it is expired, the hostname does not match, the chain is untrusted, or weak suites are in use |
6. Next Steps
- How to read details, switch views, and decode after capturing: see Data Viewing and Decoding.
- To see which connections are currently active and open a host directly from a connection: see Connection Table.
- To mine subdomains from a certificate and go further with port and subdomain discovery: see Port Scanning and Subdomain Discovery.
- To verify connectivity, path, and latency for a host: see Network Diagnostics.
Top comments (0)